Holy crap! Binance suffered a $6.3 billion theft, all starting with an employee leaving the company, with hackers planning for nearly four months! Binance's latest preliminary recap reveals that hackers targeted exchange employees, using job interviews, malware, and internal AI tools to gradually infiltrate the core wallet's signature service from employee computers. The infiltration began in June, and the attack officially took place on October 29th. 1️⃣ How did the hackers infiltrate? In June, wallet operations engineer A searched for AI programming tools and downloaded a tampered Homebrew installation package. Although Binance detected the anomaly, replaced the device, and rotated credentials, the attackers had already obtained information about the wallet team's job roles. In September, engineer B encountered a fake project director on a legitimate job search platform. He underwent a video interview with HR and then with a fake CEO, who even used social media accounts and personal photos to build trust. Finally, under the pretext of an interview assignment, the attackers tricked him into downloading a malicious code repository to his work computer. PS: This single step exposes many problems. First, the employee is highly unprofessional; downloading unapproved code in such a sensitive position is incredibly low-level. Second, the exchange is not vigilant enough in monitoring its employees' computer development environments, especially for key positions controlling wallets. They should be extremely cautious even when clicking a link, let alone downloading code. This zero-day trojan replaced legitimate development tool components, bypassing the existing endpoint security measures without the employee's knowledge. On October 20th, the hacker used B's compromised computer and Binance's internal AI tools to laterally infiltrate the computers of A and engineer C, discovering a container deployment permission token on A's computer. On October 29th, the hacker used the stolen credentials to log into C's computer, deploy a container, execute malicious scripts, and ultimately gain access to Binance's internal wallet signing service. 2️⃣ How much money was moved in 4 minutes? 5 hot wallets transferred out 233.46 million XRP in 4 minutes. Subsequently, approximately 970,500 SOL, 44.2 million OP, and 18,270 BTC were transferred out. The final transaction, involving 2,961.9 ETH, was not recorded on the blockchain until nearly four hours later. The entire incident involved approximately $6.34 billion in assets, of which approximately $2.85 billion was frozen or intercepted. 3️⃣ Why could the hacker continue transferring funds even after Binance suspended withdrawals? This is where the technical intrigue lies. The attacker submitted 50 signed transactions through the wallet signing service, manipulating the Nonce account and utilizing the Ethereum EIP-7702 mechanism to grant their controlled smart contract partial execution permissions from Binance's hot wallet. The problem is: these authorizations are already written to the blockchain, independent of Binance's normal withdrawal system. Suspending withdrawals only closes the normal withdrawal channel; it cannot automatically revoke the already effective on-chain authorizations. 4️⃣ The most awkward part: Binance's hot wallet already used MPC! Many people thought that using MPC (Multi-Party Computation) would prevent private keys from being stolen. But this incident exposed another problem: hackers don't need to directly obtain the private key; as long as they control internal permissions to call the signature service, they can bypass normal security boundaries. Furthermore, MPC doesn't have a single private key, so Binance cannot directly revoke malicious authorization with a single private key and has to design a special revocation process. The last ETH transfer was only completed at 23:56 UTC, and the EIP-7702 delegation wasn't cleared until 00:10 UTC on the 30th. MPC can protect private keys, but it cannot protect compromised employee terminals and the signature service. 5️⃣ How will Binance cover the losses now? Binance has promised to bear all losses on the platform and has prepared more than 100% coverage funds. As of October 31, 98% of the affected token assets have been replenished and can be verified via proof-of-reserve. The remaining less liquid assets are still being purchased. As of November 3, Binance has rebuilt its wallet system and internal AI tools, replaced affected devices, revoked related credentials, and completed enhanced scanning of all employee devices. The latest information from the FBI attributes this incident to North Korea. This year, Binance's security team has detected and blocked 57 suspected North Korean-related cyber threats. 6️⃣ What will this incident bring to the entire exchange industry? I think several things are almost inevitable: ① Device permissions for exchange employees will be further tightened, especially for wallet, operations, and infrastructure teams. ② Endpoint protection, abnormal behavior monitoring, and software installation auditing for employee computers will be comprehensively upgraded. Unfamiliar code repositories and development tools will be subject to stricter control. ③ Internal AI tools must re-examine permission isolation. Once AI tools become a springboard for lateral movement, they could potentially connect previously isolated systems. ④ MPC, hot wallets, and signature services need to have their emergency revocation mechanisms redesigned. It's not enough to just consider how to prevent private key leaks; the ability to quickly mitigate losses should authorization be abused. What's most frightening about this incident is that the attackers didn't even need to directly compromise Binance's core wallet system. They only needed to start with an employee's computer and gradually gain access layer by layer. A fake job posting and a malicious installation package ultimately cost the entire industry $6.3 billion in security breaches. This engineer will likely face immense psychological pressure. But the real issue to reflect on is why a compromised employee's terminal could ultimately reach the multi-billion dollar core signature system. Exchange security cannot be built on the assumption that every employee will never make mistakes.